Checkpoint the party/runtime stack before share-program and malicious-mode work.

Ship the TLS mesh, composer, Beaver/Yao/leaf MPC, prep/online paths, apps, and docs so the tree is pushable before elevating share_expr, security_mode, and prep resume.

Co-authored-by: Cursor <cursoragent@cursor.com>

examples/tools/dpf_keygen.cpp

@@ -0,0 +1,42 @@
+#include <cstring>
+#include <iostream>
+#include <string>
+
+#include "dpf/net/identity.hpp"
+
+// Party identity keys for encrypted, authenticated party links.
+//
+//   c++ -std=c++17 -I include -I thirdparty examples/tools/dpf_keygen.cpp \
+//       -lssl -lcrypto -o dpf_keygen
+//   ./dpf_keygen p0.key            # new key file (mode 600); prints the public key
+//   ./dpf_keygen --public p0.key   # public key of an existing key file
+//
+// Give each party its own key file (`identity = p0.key` in its config) and
+// give the parties that should authenticate it the printed public key
+// (`peer.0 = <public key>`).
+
+int main(int argc, char ** argv)
+{
+    try
+    {
+        if (argc == 3 && std::strcmp(argv[1], "--public") == 0)
+        {
+            std::cout << dpf::net::identity::load(argv[2]).key().base64() << "\n";
+            return 0;
+        }
+        if (argc == 2 && argv[1][0] != '-')
+        {
+            const auto id = dpf::net::identity::generate();
+            id.save(argv[1]);
+            std::cout << id.key().base64() << "\n";
+            return 0;
+        }
+        std::cerr << "usage: dpf_keygen KEYFILE | dpf_keygen --public KEYFILE\n";
+        return 2;
+    }
+    catch (const std::exception & e)
+    {
+        std::cerr << "dpf_keygen: " << e.what() << "\n";
+        return 1;
+    }
+}